CVE-2026-112894 with a CVSS score of 8.7 is a quadratic-time denial-of-service vulnerability in Pillow, specifically in the PDF save_all functionality and the PdfParser.next_object_id code path. The flaw is classified as CWE-407, an allocation of resources without limits or throttling, because processing a crafted PDF can cause computational effort to grow disproportionately with input size. An unauthenticated remote attacker can exploit it by supplying a malicious PDF file to an application that uses the affected PDF saving or parsing behavior, without requiring special privileges, complex conditions, or user interaction. The network attack vector and low complexity mean that a single request or uploaded document can trigger excessive resource consumption. The primary business impact is service degradation or outage, as affected systems may become unresponsive, consume excessive CPU or memory, and fail to process legitimate requests, potentially disrupting document workflows, user-facing applications, and downstream operations that rely on reliable PDF handling and related document processing services.
We recommend you to update Pillow to version 13.0.0.[/subscribe_to_unlock_form]
CVE-2026-112894 with a CVSS score of 8.7 is a quadratic-time denial-of-service vulnerability in Pillow, specifically in the PDF save_all functionality and the PdfParser.next_object_id code path. The flaw is classified as CWE-407, an allocation of resources without limits or throttling, because processing a crafted PDF can cause computational effort to grow disproportionately with input size. An unauthenticated remote attacker can exploit it by supplying a malicious PDF file to an application that uses the affected PDF saving or parsing behavior, without requiring special privileges, complex conditions, or user interaction. The network attack vector and low complexity mean that a single request or uploaded document can trigger excessive resource consumption. The primary business impact is service degradation or outage, as affected systems may become unresponsive, consume excessive CPU or memory, and fail to process legitimate requests, potentially disrupting document workflows, user-facing applications, and downstream operations that rely on reliable PDF handling and related document processing services.
We recommend you to update Pillow to version 13.0.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]